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Notice of Allowability 


Application No. 

10/701,400 


Applicant(s) 
DUDFIELD ET AL. 


Examiner 

PRAM I LA PARTHASARATHY 


Art Unit 

2136 





~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . |EI This communication is responsive to Amendment After Final filed on 8/1/2008. 

2. ^ The allowed claim(s) is/are 1-10,12-21,23-32; Renumbered as 1-30 . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) □ All b)DSome* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1 ) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1. 84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 

1 . □ Notice of References Cited (PTO-892) 

2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 

3. □ Information Disclosure Statements (PTO/SB/08), 

Paper No./Mail Date 

4. □ Examiner's Comment Regarding Requirement for Deposit 

of Biological Material 



5. □ Notice of Informal Patent Application 

6. □ Interview Summary (PTO-413), 

Paper No./Mail Date . 

7. ^ Examiner's Amendment/Comment 

8. ^ Examiner's Statement of Reasons for Allowance 

9. □ Other . 



/Pramila Parthasarathy/ 
Primary Examiner, Art Unit 2136 
August 14, 2008 
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Response to Arguments 

Applicant's arguments filed on 8/01/2008, with respect to Claims 1 - 33 have been fully 
considered and are persuasive. The obviousness-type double patenting of Claims 1 - 33 has 
been withdrawn and in view of amended independent claims, the prior are rejections has been 
withdrawn. 

Allowable Subject Matter 

Claims 1-10, 12-21 and 23-32 are allowed. Claims are renumbered as 1-30. 

The following is an examiner's statement of reasons for allowance: The Admitted prior 
art Gupta et al. (U.S. Patent 7,234,168) disclose "A method of provisioning a computer against 
computer attacks includes constructing a hierarchy characterizing different computer attacks 
and counter measures, and traversing this hierarchy to identify computer attacks and counter- 
measures relevant to a target platform. Detection and protection measures are collected in 
response to this traversing. These detection and protection measures are then downloaded to a 
security sensor associated with the target platform". 

However, the admitted prior arts do not disclose, teach or suggest "retrieving connection 
pairs from a connection table for a host that is attempting to gain access to another host in a 
networked computer system; 

determining whether that one host attempting to gain access has accessed the other 
host accessed previously; and if that one host has not accessed the other host previously, 

determining if other anomalies in the connection patterns of each host exist to establish 
an event severity level indicating a likelihood that the host attempting to access another host is 
attempting an unauthorized access^. 
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determining whether conditions exit to decrease the severity level assigned to an event; 
and if an event is still indicated, 

sending an event warning message with a determined level of severity to an operator ". 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the 
issue fee. Such submissions should be clearly labeled "Comments on Statement of Reasons 
for Allowance." 

An examiner's amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 
Denis G. Maloney (Registration number 29,670) on August 14, 2008. 
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IN THE CLAIMS: 

I. (Amended) A computer implemented method comprising: 

retrieving connection pairs from a connection table for a host that is attempting to gain 
access to another host in a networked computer system; 

determining whether that one host attempting to gain access has accessed the other 
host accessed previously; and if that one host has not accessed the other host previously, 

determining if other anomalies in the connection patterns of each host exist to establish 
an event severity level indicating a likelihood that the host attempting to access another host is 
attempting an unauthorized access,, 

determining whether conditions exit to decrease the severity level assigned to an event; 
and if an event is still indicated, 

sending an event warning message with a determined level of severity to an operator . 

II. (cancelled) 

12. (Amended) A computer program product embodied on a computer readable medium 
for detecting unauthorized access in a computer network comprising instructions for causing a 
computing device to: 

retrieve connection pairs from a connection table for a host that is attempting to gain 
access to another host; 

determine whether that one host attempting to gain access has accessed the other host 
accessed previously; and if that one host has not accessed the other host previously, 

determine if other anomalies in the connection patterns of each host exist to establish an 
event severity level indicating a likelihood that the host attempting to access another host is 
attempting an unauthorized access,. 
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determining whether conditions exit to decrease the severity level assigned to an event; 
and if an event is still indicated, 

sending an event warning message with a determined level of severity to an operator . 

22. (cancelled) 

23. (Amended) Apparatus comprising: 
a processing device; 

a memory; 

a computer readable medium storing a computer program product for detecting 
unauthorized access in a computer network comprising instructions for causing the device to: 

retrieve connection pairs from a connection table for a host that is attempting to gain 
access to another host; 

determine whether that one host attempting to gain access has accessed the other host 
accessed previously; and if that one host has not accessed the other host previously, 

determine if other anomalies in the connection patterns of each host exist to establish an 
event severity level indicating a likelihood that the host attempting to access another host is 
attempting an unauthorized access.,. 

determining whether conditions exit to decrease the severity level assigned to an event; 
and if an event is still indicated, 

sending an event warning message with a determined level of severity to an operator . 

33. (cancelled) 
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Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to PRAM I LA PARTHASARATHY whose telephone number is (571)272- 
3866. The examiner can normally be reached on 8:00a.m. to 5:00p.m.. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser Moazzami can be reached on 571-272-4195. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Pramila Parthasarathy/ 
Primary Examiner, Art Unit 2136 
August 14, 2008 



